CVE-2026-61612

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61612
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61612.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61612
Aliases
Related
GHSA (3)
Published
2026-09-21T17:37:17Z
Modified
2026-09-26T03:30:43Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
Details

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard validateServerUrl (added for CVE-2026-33060, extended for CVE-2026-53509) validates only the hostname string and never resolves DNS. Any caller-supplied server_url whose hostname resolves to an internal address passes the guard, so the server issues requests to loopback and cloud metadata (169.254.169.254). This is a third bypass of the same guard, and it reaches IMDS — strictly more than CVE-2026-53509, which only reached loopback. Version 0.4.108 contains an updated fix.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61612.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "@aborruso/ckan-mcp-server"
                },
                {
                    "last_affected":  "@aborruso/ckan-mcp-server"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/ondata/ckan-mcp-server

Affected ranges

Type
GIT
Repo
https://github.com/ondata/ckan-mcp-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bb7439b553b9f965adc3d43bcd415c42eebe2f40
Database specific
Show details 
{
    "source":  "REFERENCES"
}

Affected versions

v0.*
v0.3.0
v0.3.1
v0.3.2
v0.4.0
v0.4.1
v0.4.10
v0.4.100
v0.4.101
v0.4.102
v0.4.103
v0.4.105
v0.4.106
v0.4.107
v0.4.11
v0.4.12
v0.4.13
v0.4.14
v0.4.15
v0.4.16
v0.4.17
v0.4.18
v0.4.19
v0.4.2
v0.4.20
v0.4.21
v0.4.22
v0.4.23
v0.4.24
v0.4.25
v0.4.26
v0.4.27
v0.4.28
v0.4.29
v0.4.3
v0.4.30
v0.4.31
v0.4.32
v0.4.33
v0.4.34
v0.4.35
v0.4.36
v0.4.37
v0.4.38
v0.4.39
v0.4.4
v0.4.40
v0.4.41
v0.4.42
v0.4.43
v0.4.44
v0.4.45
v0.4.46
v0.4.47
v0.4.48
v0.4.49
v0.4.5
v0.4.50
v0.4.51
v0.4.52
v0.4.53
v0.4.54
v0.4.55
v0.4.56
v0.4.57
v0.4.58
v0.4.59
v0.4.6
v0.4.60
v0.4.61
v0.4.62
v0.4.63
v0.4.64
v0.4.65
v0.4.66
v0.4.67
v0.4.68
v0.4.69
v0.4.7
v0.4.71
v0.4.72
v0.4.73
v0.4.74
v0.4.75
v0.4.76
v0.4.77
v0.4.78
v0.4.79
v0.4.8
v0.4.80
v0.4.81
v0.4.82
v0.4.83
v0.4.84
v0.4.85
v0.4.86
v0.4.87
v0.4.88
v0.4.89
v0.4.9
v0.4.90
v0.4.91
v0.4.92
v0.4.93
v0.4.94
v0.4.95
v0.4.96
v0.4.97
v0.4.98
v0.4.99

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61612.json"